Entra Id
CVE-2025-55241
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Azure Entra ID Elevation of Privilege Vulnerability
AnalysisAI
Azure Entra ID Elevation of Privilege Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Affected products include: Microsoft Entra Id.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.
Authentication bypass in Microsoft Entra ID (CWE-306, missing authentication for a critical function) lets remote, unaut
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) lets a remote, unauthenticated attacker byp
Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege ne
Elevation of privilege in Microsoft Entra ID could enable an unauthenticated remote attacker to gain higher privileges,
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permission
Missing authorization in Microsoft Entra ID allows an attacker who already holds a valid low-privilege identity - a comp
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated at
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today